Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

An anonymous reader writes "A group of researchers from the University of Colorado and University of Washington could face both civil and criminal penalties for a research project (PDF) in which they snooped on users of the Tor anonymous proxy network. Should federal prosecutors take interest in the project, the researchers could also face up to 5 years in jail for violating the Wiretap Act. The researchers neither sought legal review of the project nor ran it past their Institutional Review Board. The Electronic Frontier Foundation, which has written a legal guide for Tor admins, strongly advises against any sort of network monitoring."

Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.

If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:

* Just about everything done by CAIDA [caida.org].
* The papers at IMC [imconf.net] - the Internet Measurement Conference.
* Data at CRAWDAD [dartmouth.edu] - the Community Resource for Archiving Wireless Data at Dartmouth.

A large part of computer science research consists of observing how systems are used and how they work or don't work. You can do some small-scale studies on a private system with the explicit agreement of all users, but for something as large and complicated as the Internet, the only way to do meaningful research is to observe the real thing, which necessarily means that you can't identify and get the consent of all the users involved. That's the way this field works. Responsible researchers collect the least invasive information possible for their purposes, use it benignly, and anonymise anything they release so that individual users cannot be identified. The authors of this study did exactly those things.

Now, if you want to ban all observation-based networking research, I suppose that's a legitimate position. But you have to be willing to forgo the benefits of that research. Otherwise, you should accept that the authors acted responsibly and within the norms of the field. Moreover, the purpose of this research was to understand and thereby _improve_ TOR. The researchers identified several serious problems which were already being exploited by "black hats" for malicious purposes. Research like this enables those problems to be addressed before actual harm results.

Note also it doesn't have any backup to its (misleading) headline. Usually "could face legal..." means some law enforcement agency has noticed the issue. The only one stirring up the pot here (and working pretty hard at it) seems to be the article's author.

If you do a legitimate study on the effects of different strains of marijuana, and control the genetics by growing the pot yourself, without all the impossible to get paperwork and permissions, you're going to prison.

Why should these guys be any different? In the case of the reefer nobody's hared, in these guys' cases they invaded innocent people's privacy. Not only were their actions illegal, they were highly unethical.

How is their study either unethical, or illegal as you have claimed? Ignoring your hypothetical marijuana study as completely irrelevant you seem to have missed the key points in what they did.

They did not run a "wiretap" as claimed. They monitored the traffic at a tor node that they controlled. People willingly sent them the information that was supposed to be private.

Their study is a scientific investigation into whether the privacy claims of Tor can be sustained. They cannot - the system is open to abuse. This is an entirely ethical study into the claims made by Tor, and furthermore this is exactly how good empirical science should work.

TFA explains that Tor itself doesn't do encryption. If you are using protocols that send name/pwd in clear text (like, FTP, POP, etc.), then Tor cheerfully passes those along. The most interesting thing they did IMO is seed the Tor traffic with honeypot clear text username/pwd combos and then watch for attempts to log in using those credentials, which happened almost immediately. There are hackers out there that are scooping up logins, taking advantage of the fact that people don't know (or don't care) how

TOR is not supposed to obfuscate your traffic - it doesn`t provide encryption. The sole purpose of TOR is to make it indistinguishable where did the packets come from. Anyway, if you`re using encryption, it doesn`t matter how many subverted exit nodes there are.

Look at me; still talking
when there's science to do!
When I look out there,
it makes me GLaD I'm not you.
I've experiments to run.
There is research to be done,
on the people who are
still alive.
And believe me I am
still alive.
I'm doing science and I'm
still alive.
I feel fantastic and I'm
still alive.
While you're dying I'll be
still alive.
And when you're dead I will be
still alive.
Still alive.
Still alive.

I don't wonder that the Tor people are upset by this study, because it makes some credible-looking claims that Tor does not adequately provide the anonymity it claims to. Amongst other things, the researchers warn that the design of the network can allow different actions by the same user to to be associated.

They also warn about things that have led many to doubt the project from the start: that (in their language) 'misbehaving' nodes can be set up that could take a range of actions detrimental to users.

Lest this be thought to be a hypothetical threat, consider this from their conclusion:

They also note that while they ran their node, they received numerous accusations of illegal activity, traced to their node's IP address. This has always been a danger for node operators - this test confirms it is a real threat.

Frankly, a reader of this report would be wise to reconsider Tor usage.

I don't wonder that the Tor people are upset by this study, because it makes some credible-looking claims that Tor does not adequately provide the anonymity it claims to.

I don't know where you get that idea. TOR developers are perfectly aware of TOR's limitations. They even warn you on their website [torproject.org].

They say specifically,

3. No anonymity system is perfect these days, and Tor is no exception: you should not rely solely on the current Tor network if you really need strong anonymity.

And in the list of warnings,

5. While Tor blocks attackers on your local network from discovering or influencing your destination, it opens new risks: malicious or misconfigured Tor exit nodes can send you the wrong page, or even send you embedded Java applets disguised as domains you trust.

Nothing in this study is new or ground-breaking. While I am not familiar enough with TOR to say whether if it will even be marginally useful, but I won't be surprised if there is nothing in this study that TOR developers didn't know or suspect already.

It does seem excruciatingly telling how scientists are threatened with prosecution whereas Illegal Domestic spies are treated with what almost seems like respect by the Federal Government.
Kind of a reflection on the state of science vs military these days.
Though in all honestly they should not have been doing this in the first place, but it's not easy to know 100% where the line is in research sometimes. So it would seem to me the best idea would be to reprimand them think some kind of appropriate fine, and set a precedent. That way it would be clear for later issues. I don't want to be monitored without my permission, I Don't know about you guys, even if it is for science.

Except for one blogger, no scientists have been threatened with prosecution. The article just says that they could be prosecuted, maybe, and that they should have run this by some lawyers and/or some oversight commitee.

I hope they are not reprimanded and not fined because they clearly had no intention of wiretapping anyone and made no attempt to identify individuals or correlate their actions. 150 bytes of exit data barely gets them past the TCP/UDP and IP layers.

Consistent with the 'Common Carrier' gambit we used to enforce on our telcos, perhaps the right answer is: yes they can snoop, but if they do, they are accessories to any criminal activity the exit node engages in.

It sounds like, from the very cut down version of the story that's available at the link, they didn't want to go to the effort to find out. They probably figured (correctly) it'd be a huge hassle to go through all the hurdles to get the approvals they might need. Rather than dig into it, they talked amongst themselves and decided it wasn't a big deal. Regardless of FAQ containing legal advice to the contrary. They sought minimal outside advice, and may or may not have provided enough information for the third party to make a determination, but didn't pursue it.

When engaging in activities that might be legal, but might be a felony...I'll go for safe over sorry any day.

They probably realized there will be no such prosecution, because prosecution would draw attention to how easily Tor activity can be monitored and conclusions drawn from it. That kind of attention is a Bad Thing: any government would instead prefer that citizens believe that they have access to something which is secret and anonymous (but which is actually not).

It's good to disrupt enemy communications. It's better to intercept enemy communications. It's best to eavesdrop on enemy communications when th

If the info is passing through their own network interface - by actual design of the Tor system, and not because they have done something devious - how is this analogous to wiretapping?

Illegal wiretapping surely involves breaking into private communications that you are not intended to be part of, through either physical means, or perhaps via software - but by its nature, Tor allows anyone to connect into the network, and people know that what they are sending/receiving is going to travel through other poeple's computers (but can be fairly confident that nobody can trace anything back to them easily).

I don't see how researching into the protocol and viewing the packets that pass through your own node are illegal, unless you accept some kind of contract not to snoop when you install Tor.

I, too, think this is a lame precedent. However, ownership of one end of the means of communication is no defense, as in some states where both parties must consent to recording phone calls. I'm not saying it's right, just that this is how it is in other cases.

Having said that, anyone using TOR who actually trusts the exit nodes needs their head examined. There are exit nodes which are known to be hostile, and some operators have even publicly stated they have monitored traffic and captured login/password pairs. One should never, NEVER access anything via TOR that may correlate to their meatspace life. Either use the web read-only, or set up nym accounts on sites that require registration.

The thing is that you pay your phone company and have a contract with them, and at least in those states you will know that you have the chance of being monitored as it will be part of the contract. You also know that they won't just give out those recordings to just anyone (though the government or police will probably want it at some point).

With TOR you have no contract or promise that no undesirables are listening in. There is no way of stopping someone snooping on exit nodes, so if these guys are punish

On the one hand, we have an oligopoly of carriers that the public should be able to safely assume is honest and watched over closely by regulators. Due to their power and reach and (presumed) government oversight, we should be able to trust the telcos to do no harm (recent legislation aside). And on the other hand, we have a rag-tag confederation of volunteered servers with no specific charter, ethic, no terms of service, and no oversight -- nobody with an ounce of common sen

If this witch hunt gets out of hand, we can expect to see prosecutions for "wiretapping" in cases where suspicious wives install keyloggers to snare their husbands.

From my understanding, it is legal for the wife to 'monitor' the usage of the computer because it is a shared property, aka while they are married she claims ownership of it. Now if she installed the keylogger on a computer (laptop for example) that was owned by his company, but he carried around, she would be in violation.

Well heck! It was in an FAQ? Goodness! They ignored an FAQ. This must be the first time ever in the history of the net.

But seriously. The Tor people put a little note on their software saying: "Please don't monitor the network traffic of our uber-secret software", presumably because of a fear that publicity about the nature of the websites visited by Tor users would undermine support of the project.

Illegal wiretapping surely involves breaking into private communications that you are not intended to be part of, through either physical means, or perhaps via software - but by its nature, Tor allows anyone to connect into the network, and people know that what they are sending/receiving is going to travel through other poeple's computers (but can be fairly confident that nobody can trace anything back to them easily).

I don't see how researching into the protocol and viewing the packets that pass through your own node are illegal, unless you accept some kind of contract not to snoop when you install Tor.

Think about that applied to your ISP's routers. You know your data is going through their routers. Should they be able to legally snoop on your VOIP calls, data transfers, and anything else you send through them?

Depends if it's in the contract, or if it's legal. I actually don't mind whether they're legally allowed to or not. It doesn't make much sense that they wouldn't be allowed to, seeing as it's their own hardware being used. If it's illegal for them to do so, that's nice, but I don't particularly see why it should be. It should be illegal for them to do anything malicious with the information, but why shouldn't they monitor what is going on in their own network?

Actually there is a chance that if someone breaks into your machine and you log their activities that they can hit you with the wiretapping act.
Which is why the MOTD is usually something along the lines of authorized access only blah blah, which will help your case.
http://www.honeynet.org/book/Chp8.pdf [honeynet.org] (page 4)

Actually there is a chance that if someone breaks into your machine and you log their activities that they can hit you with the wiretapping act

Heh. That is so stupid that it's actually believable that it could stand up in court these days:) Like criminals suing the owners of the house they're breaking into when they trip up on something.. that may just be an urban legend though. I fail to see how logging your own computers activities could be an issue. Doesn't the fact that they are breaking the law to get into your system take precedent? How is you monitoring activities taking place on your own property illegal? Wouldn't that make all CCTV and a

I don't get why people are comparing Tor to paid-for services and networks like ISPs and Telcos at all, it's like comparing a professional sports match with a professional referee to a game out in a public place that has no referee. You can't apply the same laws to it when it is just a bunch of people getting together without any contractual obligements or governing authority.

Presumably if they are monitoring you then it will say in your contract. The whole net neutrality thing is an ongoing debate at the m

Something that the CNET article failed to address was this: This work was _exactly_ in line with the norms and standards of networking research. It is quite normal for network operators to collect partial or full traffic traces, for both operational and research purposes.

If you believe that this study was inappropriate, then so is a very large fraction of networking measurement research. Consider at the very least:

* Just about everything done by CAIDA [caida.org].
* The papers at IMC [imconf.net] - the Internet Me

Interestingly, I was once banned from/. for running a tor node. When I found out and emailed the admins they asked if I was running a tor server - I replied in the affirmative but had since taken the node down because my SOHO router wasn't up to the task.

The/. admins were very nice and restored my access almost immediately but I found the whole process interesting.

Y'know, it's entirely possible you were banned for volume of traffic related to the tor node, and that they would have restored your access anyway, once it became apparant that that volume was due to tor and not due to you having dozens of sock puppets.

Nope. Slashdot banned tor openly, as do most online discussion systems that don't want to be flooded by endless bots.

You either ban all tor users or you allow all tor users, since any one user can just reconnect through every tor node to evade ip bans(allowing them to create new accounts if their old one was banned). Most places would rather be able to ban users, so they disallow tor exit nodes.

What is the difference between what they did and say leaving your wifi access point open to snoop on anybody that might connect to that? Either way, the other people chose to actively connect to YOUR equipment. If it is your equipment, you should have every right to monitor it in any way you see fit.

The problem is monitoring the communication itself. You can't just pick up the phone and tape record someone without their permission, or pick up a camera and videotape them. By saving the first 150b of each transmission, they were technically doing this.

TFA does a pretty good job of explaining all the varies angles - from participation without permission to individuals under 18 to international issues - but they're coming up against a number of laws, such as the Wiretap Act, which is specifically aimed at this sort of thing.

What I'm wondering though is, and I'm no tor expert, since it was so easy for these folk to set up their exit and entry nodes to log the data, what's stopping the others running tor nodes to do the same? If they can do it, surely the Chinese government could be doing the same, using it to catch all those pro-democracy bloggers. The US could (and would) definitely use this, so what's stopping them, assuming they aren't already doing it?

You can't just pick up the phone and tape record someone without their permission

Actually, you can do just that in a majority of the US. Only California, Connecticut, Delaware, Florida, Massachusetts, Maryland, Michigan, Montana, New Hampshire, Pennsylvania, and Washington require 2 party notification when recording a phone call.

Though in this case, all they have are "many people who use tor are from these places" and "people using tor often do these things", but no way to link who is doing what, as per the design of the network, as they would have to control all 7(?) nodes

What I'm wondering though is, and I'm no tor expert, since it was so easy for these folk to set up their exit and entry nodes to log the data, what's stopping the others running tor nodes to do the same?

Nothing. Those that think otherwise have fundamentally misunderstood TOR. It provides me (the end-user) the ability to get or send information from any server (through exit nodes) without anyone knowing my identity. Any information in the traffic should be considered compromised since it went unencrypted through untrusted nodes, unless otherwise secured. It's like an anonymous postcard with an anonymous return address, but still a postcard anyone could read.

As a social science undergrad, I had it drilled into my brain the importance of IRB's. Not following the review process can threaten your schools federal funding. Any grad student or professor should know better, regardless of their discipline.

Which means most of your research probably involves human subjects (assuming it involves some new data collection), so of course you have to get approval. I know all about IRB from psych courses for the same reason.

Most comp sci prof rarely run human subjects (or consider that they data they're looking at comes from human subjects) and therefore often don't need to get IRB approval. The only comp sci field that I can think of that regularly would run human subjects is HCI, and even most of those studies cou

These researchers are never going to be arrested or charged with anything.

They didnt do anything illegal.

All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.

For 4 days in December 2007, they logged and stored the first 150 bytes of each network packet that crossed their network...

They didnt do anything illegal.
All they did was copy data of packets passing THROUGH their Tor servers they had setup. They didnt compromise other's systems. This may be a moral question, ala reading emails that pass through your relay.

At which point did it become legal to read emails that were being passed through your relay?

Since we are forwarding traffic on
behalf of Tor users, our routerâ(TM)s IP address appears to be the source of sometimes
malicious traffic. The large amount of exit bandwidth that we provided caused
us to receive a large number of complaints ranging from DMCA Â512 notices
related to allegations of copyright infringement, reported hacking attempts, IRC
bot network controls, and web page defacement. However, an enormous amount
of malicious client activity was likely unreported.

Stating the obvious is a very good way to pad those reports. Especially when the professor is looking for pages of documentation. Plus, this was a finding that may have supported or contradicted a theory. In any case, it's worthy of being included in a report.

...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.

Oh well, thanks to the government, the **AA people, and idiots like this, such networks are coming... and where once terrorists, organized crime, and other ne'er do wells had to pay some geeks for serious work to make secure

...that Tor is in and of itself not secure enough. Any traffic passing over it needs intermediary obfuscation of origination and destination of traffic as well as encryption of traffic by the origination and destination separate from the Tor network similar to anonymous remailer chains.

Tor does encrypt data passing through the network, and it does obfuscate the source and destination... That's kind of the whole point. But unless the traffic is inherently encrypted (e.g. SSL), the exit node has to spit out unencrypted data, otherwise the final destination would have no idea as to what it was receiving.

Failing to submit this study to the Institutional Review Board is a *huge* professional no-no! One of the major functions of the IRB is to ensure that research doesn't violate subjects rights -- particularly confidentiality and privacy rights (which could, I suppose, be why they didn't submit it).
Even if the government decides to the let them slide (unlikely with a case of wiretapping), this has ramifications for the Universities. It can lead to the US Dept. of Education shutting down *all* of their res

I think IRB is only required when there is a chance that the subjects could be individually identified or harmed. In this case the nature of the TOR network makes that virtually impossible. I don't see the IRB issue. Wiki has the relevant exemption:

2. Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures or observation of public behavior, unless:

1. information obtained is recorded in such a manner that human subjects can

That's ridiculous! Wiretaping should be strictly defined as actually physically connecting your equipment to a wire you don't own or lease. TCP/IP is strictly point-to-point. If they got your information via Tor, it's because you ran software that specifically sent information to their IP address (or some other IP the subsequently passed it to them). If you used Tor not knowing this, that's your own fault, not theirs. If you assumed the information was undecipherable but they found that it wasn't, that's al

Joseph Javorski. Respected scientist. Touch a button. Things happen. A scientist becomes a beast. Shockwaves of an A-bomb. A once powerful, humble man. Reduced toâ¦nothing. Joseph Javorski. Respected scientist. Now a fiend. Prowling the wastelands. A prehistoric beast in a nuclear age. Kill. Kill, just to be killing.

IANAL, but following the link from the article to18 USC 2511, reading 2(d)

"It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State."

Couldn't it be argued that since they are running the TOR server, they are a 'party to the communication', and are thus covered by this exception?

I mean, the client connects to them, they're a party to that communication, they connect to the server, they're a party to that communication...

Anyone who assumes that Tor exit nodes aren't heavily monitored by lots of three letter agencies, private companies, and researchers is a fool.

If Tor's utility depended on legal protections, it would be a lost cause. What Tor actually does for you is obscure your IP address, nothing more and nothing less. That is very useful. But you still need to make sure that your content is clean. That's why Tor is often used with software like Privoxy.

If anybody actually goes after these security researchers, it's not to protect the privacy of Tor users, it's to prevent the researchers for alerting Tor users to protecting their identity better, because once 99.9% of the Tor traffic is encrypted, listening in becomes much less useful.

Thy name is government. Thanks for the laughs, America. Keep the hypocrisy factory running. You already have God's President, you might as well formalize the division of your legal system into one manipulable side for corporations, and an uncaring inflexible side for the citizenry.

The headline of the article certainly implies, even if it doesn't actually state, that these researches are actually facing charges. According to the article referenced, there is no mention whatsoever of any criminal investigation, or any evidence that these researchers have even been contacted by authorities. As far as I can tell, the entire article is based on speculation by the EFF and others. It is hard to imagine that wiretapping laws would apply here since (a) the researchers running the exit node are offering a free service and are not in the networking "business", (b) people running Tor voluntarily send their data out to Tor nodes, (c) as an exit node operator, these researchers probably cannot identify the actual people engaging in this communication (at least that should be the case if Tor is running properly), and (d) the study they released only shows aggregate data, and doesn't reveal the private communications of individual users. Doesn't there have to be a specific victim in order for wiretapping charges to apply? (IANAL, I'd love to hear from lawyers on this point.) How is this different from any other network usage study?

I still go by the old Electronic Communications Privacy act of 1986.. which basically states that as an administrator, I can monitor the activity of my network for the purposes of administration. This includes private communication.